I'm writing a program with raw-sockets and i'm trying to emulate my browser's "syn" packets to a socks server. My program's packets and my browser's packets are almost alike, but the socks server answers only my browser's packets and not my generated packets. My browser sends 5 or 3 syns (with no or very little delay between each of them), and then the socks server sends the "syn,ack" packet. The only difference between the browsers packets and mine is the timestamp in the TCP layer.
Can anyone help me with that? I can provide a packet file if necessary. Thanks :)
asked 20 Nov '10, 09:09
Ok, I compared your traces and the only thing that seems to be "off" in the raw socket version is that the TCP checksum is not correct. This is something that could be a result of TCP Checksum offloading (which is why many people turn off TCP checksum validation in Wireshark), but I think it is the problem in this case. Here's why:
I hope this makes sense to you. Steps to take are:
If your raw socket program does in fact calculate correct TCP checksums and Wireshark only says they're wrong because of checksum offloading I can't tell why your packets aren't answered, since everything else looks pretty much the same as the browser's packets.
answered 04 Dec '10, 13:52
yes, here are the traces of both my program and the browser.
my wireshark saved those files without extension, but I guess they are .cap files.
answered 04 Dec '10, 11:51